unkin-agent
78ba0011f9
Configure the arrstack Vault secrets engine (backend config + roles) from terraform-vault, matching the schema declared in terraform-vault #127. - Add terraform-plugin-framework provider (local name arrstack) authenticating to Vault/OpenBao via address + token (VAULT_ADDR/VAULT_TOKEN fallback). - Add arrstack_secret_backend resource: mounts the engine and writes <mount>/config. - Add arrstack_secret_backend_role resource: manages <mount>/roles/<name>. - Add Vault client, conversions, unit tests, Makefile, woodpecker CI + tag release to artifactapi terraform-unkin, examples, and README.
12 lines
386 B
Terraform
12 lines
386 B
Terraform
# A role that mints short-lived arrproxy API keys scoped to a subset of the arr
|
|
# apps. Reading arrstack/creds/<role> returns a lease-bound key that the engine
|
|
# revokes when the lease ends.
|
|
resource "arrstack_secret_backend_role" "sonarr" {
|
|
backend = arrstack_secret_backend.arrstack.path
|
|
name = "sonarr"
|
|
apps = ["sonarr"]
|
|
|
|
ttl = 60 # 1m
|
|
max_ttl = 86400 # 24h
|
|
}
|